Deck 6: Firewalls

Question 1

Firewalls will drop ________.

A) suspicious packets
B) provable attack packets
C) Both A and B
D) Neither A nor B

Answer 1

B

Question 2

Almost all main border firewalls use ________ filtering as their primary filtering mechanism.

A) unified threat management
B) application proxy
C) static packet filtering
D) None of the above

Answer 2

D

Question 3

In ________ filtering, the firewall examines packets entering the network from the outside.

A) ingress
B) egress
C) Both A and B
D) Neither A nor B

Answer 3

A

Question 4

Static packet filtering is sometimes used ________.

A) as a secondary filtering mechanism on an application proxy firewall
B) on border routers
C) Both A and B
D) Neither A nor B

Question 5

An internal firewall sits at the boundary between the corporate site and the Internet.

Question 6

If a firewall receives a packet that is suspicious, it will drop and log the packet.

Question 7

Static packet filtering firewalls are limited to ________.

A) inspecting packets for which there are good application proxy filtering rules
B) inspecting packets in isolation from their context
C) Both A and B
D) Neither A nor B

Question 8

In ________ filtering, the firewall filters packets when they are leaving the network.

A) ingress
B) egress
C) Both A and B
D) Neither A nor B

Question 9

In ingress filtering, the firewall examines packets entering the network from the outside, typically from the Internet.

Question 10

Wire speed is the maximum speed at which a firewall can filter packets.

Question 11

A ________ firewall handling all traditional firewall functions (SPI, ACLs, etc.) as well as additional security functions such as antivirus filtering, spam filtering, application proxy filtering, and so forth.

A) unified threat management
B) stateful packet inspection
C) static packet inspection
D) None of the above

Question 12

SPI firewalls can conduct ________ inspection.

A) stateful packet
B) static packet filtering
C) Both A and B
D) Neither A nor B

Question 13

If a firewall has to drop packets because it cannot keep up with traffic volume, this is ________.

A) good because it will prevent possible attack packets from entering the network
B) bad because valid, non-attack packets will be dropped and this will effectively created a self-generated DOS attack
C) Both A and B
D) Neither A nor B

Question 14

________ firewalls filter traffic passing between different parts of a site's network.

A) Border
B) Internal
C) Intermediate
D) None of the above

Question 15

A connection opening is a state.

Question 16

A border firewall sits at the boundary between the corporate site and the external Internet.

Question 17

If a firewall receives a suspicious packet, the firewall will ________.

A) log the packet
B) drop the packet
C) Both A and B
D) Neither A nor B

Question 18

If a firewall receives a provable attack packet, the firewall will ________.

A) log the packet
B) drop the packet
C) Both A and B
D) Neither A nor B

Question 19

The purpose of egress firewall filtering is to stop attack packets from entering the firm's internal network.

Question 20

If a firewall cannot keep up with traffic volume, it will ________.

A) continue passing all packets but slow operation
B) drop packets it cannot process
C) pass any packets it cannot filter
D) shut down, failing safely

Question 21

In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that does not attempt to open a connection.

Question 22

Both TCP and UDP can be used by an application .

Question 23

A connection designates a specific program designated by a port number on a specific computer's IP address.

Question 24

The last egress ACL rule in a border firewall is DENY ALL.

Question 25

A socket designates a specific program designated by a port number on a specific computer's IP address.

Question 26

What is the SPI firewall rule for packets that only have their TCP ACK bits set but no other flags set?

A) Drop the packet unless it is permitted by an ACL
B) Pass the packet unless it is forbidden by an ACL
C) Pass the packet if it is part of a previously approved connection
D) Either A or B

Question 27

A ________ is a persistent conversation between different programs on different computers.

A) connection
B) state
C) Both A and B
D) Neither A nor B

Question 28

Ingress ACL rules typically permit a specific type of internally originated connection to outside resources.

Question 29

Ingress ACL rules typically permit a specific type of externally originated connection to network resources.

Question 30

A ________ port number designates a specific application running on a server.

A) well-known
B) ephemeral
C) Both A and B
D) Neither A nor B

Question 31

Most packets are part of the ________ state.

A) connection opening
B) connection closing
C) Both A and B
D) Neither A nor B

Question 32

SPI firewalls cannot handle UDP communications because UDP is connectionless.

Question 33

A state is a distinct phase in a connection between two applications.

Question 34

What is the SPI firewall rule for packets that do not attempt to open connections?

A) Drop the packet unless it is permitted by an ACL
B) Pass the packet unless it is forbidden by an ACL
C) Pass the packet if it is part of a previously approved connection
D) Either A or B

Question 35

Which of the following is one of the two simple DEFAULT SPI firewall rules for packets that attempt to open connections?

A) Permit all attempts to open a connection from an internal host to an external host
B) Permit all attempts from external hosts to open a connection with an internal host
C) Both A and B
D) Neither A nor B

Question 36

SPI filtering for packets that are part of ongoing communications is usually simple.

Question 37

A connection between two programs on different computers is represented by its ________.

A) pair of IP addresses
B) pair of port numbers
C) pair of sockets
D) None of the above

Question 38

It is better to have an ACL that permits access to a single internal webserver than one that allows access to all internal webservers.

Question 39

In ingress and egress filtering, an SPI firewall always considers its ACL rules when a new packet arrives that attempts to open a connection.

Question 40

SPI firewalls can handle both ICMP and UDP.

Question 41

If you will proxy 8 different applications, you will need ________ proxy programs.

A) 2
B) 4
C) 6
D) 8

Question 42

Application proxy firewalls can always examine application layer content.

Question 43

The combination of high safety and low cost makes SPI firewalls extremely popular.

Question 44

IDSs tend to issue many false negatives.

Question 45

Automatic protections for application proxy firewalls include ________.

A) protocol fidelity
B) header destruction
C) Both A and B
D) Neither A nor B

Question 46

________ drop packets.

A) Firewalls
B) IDSs
C) Both A and B
D) Neither A nor B

Question 47

Stateful packet inspection firewalls use relay operation with two connections per client/server pair.

Question 48

________ firewalls always examine application messages in depth.

A) Static packet filtering
B) SPI
C) Application proxy
D) All of the above

Question 49

Today, application proxy firewalls are commonly used ________.

A) to protect internal clients from malicious external servers
B) as main border firewalls
C) Both A and B
D) Neither A nor B

Question 50

Stateful packet inspection firewalls are ________.

A) expensive
B) fairly safe in practice
C) Both A and B
D) Neither A nor B

Question 51

If you will proxy four different applications, how many proxy programs will you need?

A) 1
B) 2
C) 4
D) 8

Question 52

NAT is able to stop ________.

A) scanning probes
B) sniffers from learning anything about the internal IP address of internal hosts
C) Both A and B
D) Neither A nor B

Question 53

There is(are) ________ NAT traversal method(s).

A) 1
B) 2
C) 7
D) several

Question 54

Attacks other than application level attacks usually fail to get through SPI firewalls.

Question 55

Main border firewalls rarely use stateful packet inspection.

Question 56

The NAT firewall places only the internal socket in the translation table.

Question 57

Nearly all applications can be proxied effectively.

Question 58

Nearly all main border walls today use ________ filtering.

A) unified threat management
B) stateful packet inspection
C) static packet inspection
D) All of the above

Question 59

An application proxy firewall needs have multiple proxy programs if it is to filter multiple application protocols.

Question 60

Stateful packet inspection firewalls ________.

A) always do application content filtering
B) have the slow speed of relay operation
C) Both A and B
D) Neither A nor B

Question 61

After an antivirus server performs filtering, it may ________.

A) drop the object
B) send the object to the firewall to pass to the destination
C) pass the object to the destination directly
D) All of the above

Question 62

Firewall policies should govern ________.

A) configuration
B) testing
C) Both A and B
D) Neither A nor B

Question 63

If an IPS identifies an attack, it can ________.

A) drop the attack packet(s)
B) limit suspicious traffic to a certain percentage of the total bandwidth
C) Both A and B
D) Neither A nor B

Question 64

Which IPS response to an attack can do the most damage?

A) Dropping packets
B) Limiting suspicious traffic to a certain percentage of the total bandwidth
C) Both A and B do equal amounts of damage
D) Neither A nor B

Question 65

In a firewall policy database, the source field and destination field are fairly explanatory.

Question 66

IDSs need to filter individual packets rather than packet streams.

Question 67

The firewall should go through vulnerability testing after each change.

Question 68

________ drop packets.

A) IDSs
B) IPSs
C) Both A and B
D) Neither A nor B

Question 69

Bandwidth limitation for certain types of traffic is less risky than dropping packets.

Question 70

Firewall appliances need little or no hardening before they are installed.

Question 71

Which IPS response to an attack is the most effective in stopping attacks?

A) Dropping packets
B) Limiting suspicious traffic to a certain percentage of the total bandwidth
C) Both A and B are equally effective
D) Neither A nor B

Question 72

Antivirus servers can look for ________.

A) viruses
B) worms
C) Trojan horses
D) All of the above

Question 73

Centralized firewall management systems automatically create ACLs from policies.

Question 74

IDSs drop packets that are merely suspicious.

Question 75

Antivirus servers can only find viruses, not other types of malware.

Question 76

What type of filtering do IDSs do?

A) Deep packet inspection
B) SPI filtering
C) Both A and B
D) Neither A nor B

Question 77

What type of filtering do IDSs do?

A) Packet stream analysis
B) SPI filtering
C) Both A and B
D) Neither A nor B

Question 78

Firewalls do not stop provable attack packets

Question 79

What time of filtering do UTM firewalls provide?

A) IDS Service
B) Antivirus filtering
C) Both A and B
D) Neither A nor B

Question 80

________ do not drop packets.

A) IDSs
B) IPSs
C) Firewalls
D) All of the above drop packets.